初始提交：项目基础结构

- backend: FastAPI 后端服务 (Python)
- frontend: React + Tauri 前端应用
- docker-compose.yml: 容器编排配置

backend/app/core/config.py

@@ -0,0 +1,33 @@
+"""核心配置 — Pydantic Settings 自动从 .env 读取"""
+import json
+from pydantic_settings import BaseSettings
+
+
+class Settings(BaseSettings):
+    # ---- 数据库 ----
+    DATABASE_URL: str = "postgresql+asyncpg://track:track_prod_2026@localhost:5433/track_production"
+
+    # ---- JWT ----
+    SECRET_KEY: str = "change-me-in-production"
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
+
+    # ---- 调试 ----
+    DEBUG: bool = True
+
+    # ---- CORS 跨域白名单（JSON 数组字符串，直接从 .env 的 CORS_ORIGINS 读取） ----
+    CORS_ORIGINS: str = '["http://localhost:1420", "tauri://localhost"]'
+
+    @property
+    def CORS_ORIGINS_LIST(self) -> list[str]:
+        """将 JSON 字符串解析为 Python list，供 CORSMiddleware 使用"""
+        try:
+            return json.loads(self.CORS_ORIGINS)
+        except (json.JSONDecodeError, TypeError):
+            return ["http://localhost:1420", "tauri://localhost"]
+
+    class Config:
+        env_file = ".env"
+        extra = "ignore"
+
+
+settings = Settings()

backend/app/core/database.py

@@ -0,0 +1,24 @@
+"""数据库连接 — 异步引擎 + 连接池"""
+from sqlalchemy.ext.asyncio import create_async_engine, async_sessionmaker, AsyncSession
+from app.core.config import settings
+
+engine = create_async_engine(
+    settings.DATABASE_URL,
+    echo=settings.DEBUG,
+    pool_size=20,         # 连接池常驻连接数
+    max_overflow=10,      # 超出 pool_size 时最多再创建的连接数
+    pool_recycle=3600,    # 连接回收时间（秒），防止 MySQL 8 小时断连
+    pool_pre_ping=True,   # 每次取出连接前先 ping 检测可用性
+)
+
+AsyncSessionLocal = async_sessionmaker(
+    engine,
+    class_=AsyncSession,
+    expire_on_commit=False,
+)
+
+
+async def get_db() -> AsyncSession:
+    """FastAPI 依赖注入：每次请求获取一个数据库会话"""
+    async with AsyncSessionLocal() as session:
+        yield session

backend/app/core/security.py

@@ -0,0 +1,29 @@
+"""安全模块 — JWT Token 生成与验证"""
+from datetime import datetime, timedelta, timezone
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+from app.core.config import settings
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+ALGORITHM = "HS256"
+
+
+def create_access_token(data: dict, expires_delta: timedelta | None = None) -> str:
+    """生成 JWT Access Token"""
+    to_encode = data.copy()
+    expire = datetime.now(timezone.utc) + (
+        expires_delta or timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+    )
+    to_encode.update({"exp": expire})
+    return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=ALGORITHM)
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    """验证明文密码 vs 哈希密码"""
+    return pwd_context.verify(plain_password, hashed_password)
+
+
+def hash_password(password: str) -> str:
+    """对明文密码进行哈希"""
+    return pwd_context.hash(password)